Executive Summary
| Summary | |
|---|---|
| Title | trousers security, bug fix, and enhancement update |
| Informations | |||
|---|---|---|---|
| Name | RHSA-2014:1507 | First vendor Publication | 2014-10-14 |
| Vendor | RedHat | Last vendor Modification | 2014-10-14 |
| Severity (Vendor) | Low | Revision | 02 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 5 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Problem Description: Updated trousers packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64 Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux HPC Node (v. 6) - x86_64 Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64 3. Description: TrouSerS is an implementation of the Trusted Computing Group's Software Stack (TSS) specification. You can use TrouSerS to write applications that make use of your TPM hardware. TPM hardware can create, store and use RSA keys securely (without ever being exposed in memory), verify a platform's software state using cryptographic hashes and more. A flaw was found in the way tcsd, the daemon that manages Trusted Computing resources, processed incoming TCP packets. A remote attacker could send a specially crafted TCP packet that, when processed by tcsd, could cause the daemon to crash. Note that by default tcsd accepts requests on localhost only. (CVE-2012-0698) Red Hat would like to thank Andrew Lutomirski for reporting this issue. The trousers package has been upgraded to upstream version 0.3.13, which provides a number of bug fixes and enhancements over the previous version, including corrected internal symbol names to avoid collisions with other applications, fixed memory leaks, added IPv6 support, fixed buffer handling in tcsd, as well as changed the license to BSD. (BZ#633584, BZ#1074634) All trousers users are advised to upgrade to these updated packages, which correct these issues and add these enhancements. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 781648 - CVE-2012-0698 trousers: DoS vulnerability in tcsd |
Original Source
| Url : https://rhn.redhat.com/errata/RHSA-2014-1507.html |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:20052 | |||
| Oval ID: | oval:org.mitre.oval:def:20052 | ||
| Title: | DSA-2576-1 trousers - denial of service | ||
| Description: | Andy Lutomirski discovered that tcsd (the TPM userspace daemon) was missing input validation. Using carefully crafted input, it can lead to a denial of service by making the daemon crash with a segmentation fault. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2576-1 CVE-2012-0698 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 6.0 Debian GNU/kFreeBSD 6.0 | Product(s): | trousers |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:25746 | |||
| Oval ID: | oval:org.mitre.oval:def:25746 | ||
| Title: | SUSE-RU-2013:0352-1 -- Recommended update for trousers | ||
| Description: | This collective update for the trousers library and daemon fixes the following issues: * One minor security issue for cases where tcsd is enabled for TCP: CVE-2012-0698: tcsd in TrouSerS allowed remote attackers to cause a denial of service (daemon crash) via a crafted type_offset value in a TCP packet to port 30003. * An issue in the trousers library which prevents disabling of TPM physical presence. | ||
| Family: | unix | Class: | patch |
| Reference(s): | SUSE-RU-2013:0352-1 CVE-2012-0698 | Version: | 3 |
| Platform(s): | SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Desktop 11 | Product(s): | trousers |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:26927 | |||
| Oval ID: | oval:org.mitre.oval:def:26927 | ||
| Title: | RHSA-2014:1507: trousers security, bug fix, and enhancement update (Low) | ||
| Description: | TrouSerS is an implementation of the Trusted Computing Group's Software Stack (TSS) specification. You can use TrouSerS to write applications that make use of your TPM hardware. TPM hardware can create, store and use RSA keys securely (without ever being exposed in memory), verify a platform's software state using cryptographic hashes and more. A flaw was found in the way tcsd, the daemon that manages Trusted Computing resources, processed incoming TCP packets. A remote attacker could send a specially crafted TCP packet that, when processed by tcsd, could cause the daemon to crash. Note that by default tcsd accepts requests on localhost only. (CVE-2012-0698) Red Hat would like to thank Andrew Lutomirski for reporting this issue. The trousers package has been upgraded to upstream version 0.3.13, which provides a number of bug fixes and enhancements over the previous version, including corrected internal symbol names to avoid collisions with other applications, fixed memory leaks, added IPv6 support, fixed buffer handling in tcsd, as well as changed the license to BSD. (BZ#633584, BZ#1074634) All trousers users are advised to upgrade to these updated packages, which correct these issues and add these enhancements. | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2014:1507-01 CVE-2012-0698 CESA-2014:1507 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 6 CentOS Linux 6 | Product(s): | trousers |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:27119 | |||
| Oval ID: | oval:org.mitre.oval:def:27119 | ||
| Title: | ELSA-2014-1507 -- trousers security, bug fix, and enhancement update | ||
| Description: | [0.3.13-2] - Fix strict alias warning [0.3.13-1] - New upstream bug fix release resolves: #633584 - Pick up latest TrouSerS package resolves: #1074634 - Buffer overflow detected in TrouSerS daemon | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2014-1507 CVE-2012-0698 | Version: | 4 |
| Platform(s): | Oracle Linux 6 | Product(s): | trousers trousers-devel trousers-static |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2012-11-26 | Name : Debian Security Advisory DSA 2576-1 (trousers) File : nvt/deb_2576_1.nasl |
| 2012-09-11 | Name : Fedora Update for trousers FEDORA-2012-12973 File : nvt/gb_fedora_2012_12973_trousers_fc17.nasl |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2015-01-19 | Name : The remote Solaris system is missing a security patch for third-party software. File : solaris11_tcsd_20121120.nasl - Type : ACT_GATHER_INFO |
| 2014-11-12 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2014-1507.nasl - Type : ACT_GATHER_INFO |
| 2014-10-23 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20141014_trousers_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
| 2014-10-17 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2014-1507.nasl - Type : ACT_GATHER_INFO |
| 2014-10-14 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-1507.nasl - Type : ACT_GATHER_INFO |
| 2012-11-26 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2576.nasl - Type : ACT_GATHER_INFO |
| 2012-09-10 | Name : The remote Fedora host is missing a security update. File : fedora_2012-12973.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-11-13 13:27:24 |
|
| 2014-10-18 13:26:18 |
|
| 2014-10-16 13:25:50 |
|
| 2014-10-14 09:22:22 |
|
